Bafin raises the bar on virtual IBAN compliance

EU RegCORE Client Alert | German Regulatory Developments

QuickTake

On 27 July 2026, the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – Bafin) published Supervisory Communication (“Aufsichtsmitteilung”) 06/2026Available only in German: https://www.bafin.de/SharedDocs/Downloads/DE/Anlage/Aufsichtsmitteilung/dl_2026_07_27_Aufsichtsmitteilung_06_virtuelleIBAN.html?nn=149494Show Footnote together with an accompanying interview explaining its supervisory concerns regarding the use of virtual IBANs (vIBANs) in connection with underground banking and money laundering.See details, available at the time of writing, only in German here.Show Footnote The supervisory communication applies immediately and will remain in force until the EU Anti-Money Laundering Regulation (AMLR) becomes applicable on 10 July 2027.

The publication is significant not because Bafin questions the legitimacy of vIBANs themselves, but because it recognises that certain complex implementation models may create opacity over the identity of end customers, beneficial ownership and payment flows. Bafin’s message is nuanced: vIBANs are legitimate payment infrastructure that underpin many modern financial services business models, but where they reduce transparency, they require correspondingly stronger Anti-Money-Laundering (AML)/Combating the Financing of Terrorism (CFT) controls. This supervisory communication should therefore be viewed as a governance and operating model challenge rather than a restriction on innovation. It should also be read in conjunction but also in contrast with the European Banking Authority’s (EBA) ongoing work on vIBANs.

Bafin’s publication is particularly relevant for banks providing master accounts, payment institutions, electronic money institutions, Banking-as-a-Service providers, embedded finance platforms, treasury providers and firms operating cross-border payment infrastructures.

Bottom line: Bafin’s supervisory communication does not restrict the use of vIBANs. It requires firms to demonstrate that governance, customer transparency and monitoring arrangements have evolved at the same pace as the payment infrastructure itself. Innovation is welcome. Opacity is not. At the same time Bafin’s communication marks a wider shift in supervisory tone as well as new principles  that the EBA and/or other national competent authorities (NCAs) may follow.